JPH06103467B2 - Preventing malfunction of automobile computer - Google Patents

Description

Detailed Description of the Invention [Industrial applications]

The present invention relates to a malfunction prevention method for an automobile computer, which prevents malfunction in computer control.

[Prior art]

An electronic circuit including a control microcomputer mounted on an automobile is placed in a bad environment such as temperature, humidity, vibration, and electrical noise, and thus requires high-level electronic technology.
With respect to the destruction of electronic equipment, the corresponding technology has advanced remarkably due to technological progress, so at this stage, using these, it is almost in a satisfactory state, but the problem of malfunction in program control is It has not been fully resolved. In particular, a microcomputer that executes long steps in sequence may run out of control when only one noise enters, causing a serious situation such as engine stop during running due to a malfunction of the computer for engine control. become. Therefore, in order to avoid such a worst situation, a lot of filters are used to prevent noise from being mixed in the electronic control part, or a watchdog circuit is externally attached, and periodically during the software processing process of the computer. Alternately outputs "H" and "L" state pulses to a specific output port as a program run signal,
It has been proposed to monitor the watchdog circuit, detect that it has stopped, judge "CPU runaway", reset the CPU and other parts, and restore the normal state. Recently, there are dedicated ICs for the "watchdog circuit" mentioned above, and a microcomputer with an on-chip watchdog circuit has been announced. However, since the watchdog circuit is added, the cost increases, and a problem of malfunction of the circuit itself arises. In particular, the decisive flaw of this method is that the malfunction cannot be returned to the normal state until the malfunction of the CPU affects the outside (until the watchdog circuit works). In the case of multi-task processing that can perform interrupt processing, if the interrupt disable flag is set due to a malfunction, necessary interrupt control cannot be performed, resulting in serious problems such as operation control being disabled. Will end up. Malfunction of the control computer of a car is an extremely rare phenomenon, and occurs at a rate of, for example, 1 in tens of thousands, and
Although it occurs only about once every tens of thousands of kilometers running, various tests have shown that the information obtained indicates that the internal registers of the CPU may be affected by ignition noise or power surge immediately before the computer malfunctions. It was found that this was due to changes in the content held in. That is, the CPU
Despite the execution of a normal program, malfunctions are caused by changes in the register contents. This phenomenon is often observed in the multi-task processing that performs interrupt processing in addition to the main routine. It should be noted that Japanese Patent Laid-Open No. 57-7832 counts interrupt request circuits that are generated at regular intervals, clears the count value of the interrupt request frequency when an interrupt is established, and continues until the count reaches a constant value. When an interrupt does not occur, it is detected as a program error, and when a program error is detected, the emergency control circuit is activated and the interrupt function restarts the program processing from a specific address. When interrupt prohibition is set in the flag and program processing is performed in a state where the interrupt is not generated, this is detected when the program runs out of control due to a program bug or the like and the interrupt prohibition flag is no longer released, and program error processing is performed. A technique for remedying the above is disclosed.

[Problems to be Solved by the Invention]

However, in the above prior art example, the counting circuit counts the number of interrupt requests from the interrupt generation request circuit,
A failure detection circuit that clears the count value of the number of interrupt requests when an interrupt is established and detects a program error when an interrupt does not occur until the count value by the counting circuit reaches a certain value is required. When a program abnormality is detected by, activate the emergency control circuit,
After switching the central control unit and the main storage unit to the standby system, the interrupt function is used to restart the program processing from a specific address, and the configuration of the control system is complicated.
Further, in the case where the central control unit or the like does not have a backup system, it is impossible to prevent the runaway of the CPU by merely detecting the program abnormality. Moreover, even if the program processing is simply restarted from a specific address as a relief for the program abnormality processing, the interrupt prohibition flag remains set, and the root cause is not solved, and the operation by the emergency control circuit continues. , Cannot return to normal normal processing. The present invention has been made in view of the above circumstances, and an illegal signal due to ignition noise, a power surge, or the like may be input in a program execution process to affect a register, and an interrupt prohibition flag may be set. Also, when necessary interrupt processing is not performed for a certain period of time while the program is in progress, an interruptable state is reproduced, the necessary interrupt processing is enabled, and malfunctions can be prevented in advance. It is intended to provide a malfunction prevention method.

[Means for Solving the Problems]

In order to achieve the above object, a method for preventing malfunction of an automobile computer according to the present invention executes a normal processing routine and, in an automobile computer that executes an interrupt processing routine when an interrupt request is generated, the normal processing routine During execution, the time during which the interrupt process is not executed is timed, and when the interrupt process is not executed within a preset predetermined time, the interrupt prohibition cancellation process is executed.

[Action]

According to the present invention, during the execution of the normal processing routine, when the interrupt processing is not executed within the preset predetermined time,
The interrupt prohibition cancellation processing is executed to cancel the interrupt prohibition. Therefore, even if an illegal signal is input and the interrupt disable flag is raised, this is resolved early and the interrupt request is ignored.
It is possible to reliably prevent the CPU from running out of control, and prevent malfunctions caused by computer control.

【Example】

An embodiment of the present invention will be described below with reference to FIGS. 1 and 2. FIG. 1 shows an example of a vehicle-mounted computer embodying the present invention, which is used for engine control such as fuel injection and ignition control, or vehicle speed control. In FIG. 1, reference numeral 1 denotes various sensors that supply necessary control parameters to the CPU 6, and these sensors 1 are connected to an input / output unit 5 via an input interface 3. Reference numeral 2 denotes various control actuators, which are driven by drive signals output from the input / output unit 5 via the output interface 4. The input / output unit 5 is connected to the CPU 6 via the bus line 9, and the CPU 6 processes the output of the sensor 1 to output commands for driving various actuators 2.
An interrupt line 10 is connected to the CPU 6 from the input / output unit 5, and an interrupt processing request to the CPU 6 can be made from the input / output unit 5 for an input / output signal. In addition, reference numeral 8 is a ROM having a built-in processing procedure of the CPU 6,
Reference numeral 7 is a RAM used for temporary saving of data, etc., and each is connected to the CPU 6 via a bus line 9. The input / output unit 5 is usually composed of a general-purpose LSI and employs a programmable option that selects a plurality of functions by software. In this programmable option, a constant is written from a CPU 6 to a predetermined register. , The function is uniquely determined. Next, the malfunction prevention method according to the present invention will be specifically described with reference to FIGS. 2 (a) and 2 (b). First, a normal processing routine will be described with reference to FIG. 2A. In step S1, normal processing is performed.
Next, in step S2, the value TIME stored in the predetermined address of RAM7 is incremented, and this incremented value TIME is compared with the preset value of TIME (1) in step S3. Is equal to the value of (1),
If it is more than that, go to step S4, but if not, return to step S1. Further, in steps S4 and S5, a predetermined malfunction prevention countermeasure routine is executed. For example, resetting the interrupt disable flag to "0"
Alternatively, interrupt prohibition cancellation processing is performed such as initialization (set to “0”). On the other hand, when an interrupt occurs from the outside, the CPU 6 suspends the above-mentioned normal processing routine (main routine) and executes the interrupt processing routine shown in FIG. 2 (b). First, in step S1, interrupt processing is performed. Next, in step S12, clear TIME (return to "0"),
In step S13, the process returns to the main routine. Thus, if the interrupt is taken normally, TIME
However, if an illegal signal is input due to ignition noise, power surge, etc., and the register contents change, and the interrupt disable flag is set, this will not be executed even if there is an interrupt request. The routine of is repeated,
The value of TIME reaches TIME (1) as a result of the increment. As a result, the interruption prohibition is released, and the interruption can be performed at least every predetermined time. Therefore, the CPU 6 can prevent a serious malfunction without ignoring the interruption request.

【The invention's effect】

As described above, according to the present invention, during the execution of the normal processing routine, when the interrupt processing is not executed within the preset predetermined time, the interrupt prohibition cancellation processing is executed and the interrupt prohibition is canceled. Even if an illegal signal may be generated due to ignition noise or power surge while the program is in progress and the interrupt prohibition flag may be set, this is resolved early and the interrupt request can be ignored by the CPU in a very simple method. Can be surely prevented from running away, and malfunction due to computer control can be prevented in advance.
Further, even if the CPU or the like does not have a backup system, it is possible to reliably prevent runaway of the CPU due to ignoring interrupt requests, and prevent malfunctions due to the automobile computer. Further, when the interrupt processing is not executed within the predetermined time, the interrupt prohibition is released, so that the interrupt prohibition flag can be cleared and the normal normal state in which the interrupt processing can be executed can be easily restored.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a computer for carrying out the method of the present invention, and FIGS. 2 (a) and 2 (b) are flowcharts showing a control procedure. 1 ... Sensor, 2 ... Actuator, 3 ... Input interface, 4 ... Output interface, 5 ... Input / output unit, 6 ... CPU, 7 ... RAM, 8 ... ROM, 9 ... Bus line, 10 …… Interrupt line.

Claims (1)

[Claims] 1. An automobile computer for executing an ordinary processing routine and executing the interrupt processing routine when an interrupt request is generated, measures the time during which the interrupt processing is not executed during the execution of the ordinary processing routine, and A method for preventing malfunction of a computer for an automobile, characterized in that interrupt processing is executed when interrupt processing is not executed within a set predetermined time.